Splunk Alerting by Email Error - 501 5.5.4 Invalid Domain Name


We configured some alerts that should send an email when fired, but no email gets through. We noticed errors in the internal log that said:

05-26-2014 17:32:56.527 +0200 ERROR ScriptRunner - stderr from 'E:\splunk\etc\apps\search\bin\': ERROR:root:(501, '5.5.4 Invalid domain name') while sending mail to:

The SMTP server itself logs:

2014-05-26T05:38:08.117Z,SV0490\Relay SV0490,08D1455F6B42D2E9,3,,,<,ehlo,
2014-05-26T05:38:08.117Z,SV0490\Relay SV0490,08D1455F6B42D2E9,4,,,*,Tarpit for '0.00:00:05',
2014-05-26T05:38:13.125Z,SV0490\Relay SV0490,08D1455F6B42D2E9,5,,,>,501 5.5.4 Invalid domain name,
2014-05-26T05:38:13.125Z,SV0490\Relay SV0490,08D1455F6B42D2E9,6,,,<,helo,
2014-05-26T05:38:13.125Z,SV0490\Relay SV0490,08D1455F6B42D2E9,7,,,*,Tarpit for '0.00:00:05',
2014-05-26T05:38:18.133Z,SV0490\Relay SV0490,08D1455F6B42D2E9,8,,,>,501 5.5.4 Invalid domain name,

The mail admins said that our source IP should be free to send with any source address - we configured splunk@server, without any success. We also changed the server name in the General Settings to the FQDN but nothing helped.
We believe that it has to do with the name sent after HELO/EHLO but we cant see what it is.
We have no idea what the reason for this behaviour could be.

Any ideas?


if you have some org specific email id which deviates from our general email format you may take a look at the below answer. Splunk has mentioned a specific email id format.


0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!